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SYOTEMFORCOKTROLUNGANOFERATIONALSTATEOF 
ELECTRONIC CIRCCnS 

BACKGROUND OFTHEINVENTION 

p„>vidcd ,o, by a,. ^ of Cootrac No. DAA.O,-91-C-A004. 

1 p;p>lH of the Invention 

Thi,tevention.ela,es>oa.^ara.usa«dm=UK»lf<>r "loddngou, 

p.^„ Of olec^ca. circuits, U.c n^x being capable o, ov«rtdiag op^ 

T^^iss.o^i»no.voU.eo^.»P«— 
„^ by electric power ii.tem.ptio. or shut down. 

MaintenanceonhigbvoitageeUctriCoircui.sundcre,ecn«power. 
..Her.tno«ntobepowe,edorno.-..o.„tobepo«erea.presen.s..gn^s,fe. 
^ B.ec.roc«.ion.seve.ce.ec.ricais.K..injur,.orfi.can,esu,...«.a. 
e..c.rica.ci.coU.h«is.hougt«no..ob.rccei™,eiec.ricaic„nen.ac.^^^ 
"ivingeicctriCcurren. ..ess severe cases. bun«d wires, datnaged connecters and 
rnI.iyaa.«sede,ect,ica.co..nen.soreircuitscan.esuH...nsueHas.u^^^^^^ 

nLsonitisMg«,desirab.e....circuitsunder.uaintenancebe.™own^ 
.unpoweredorde^ergizedstatcsucbtbatre-appucationorpowerca^^toccur 

v^dKMt a deliberate action b, authorized personnel. 

,ncon«ntiona.tecbno.og,vehicles.suchasheucop.ers.elecu.ca. 

hv mechanical circuit breakers that can be 
circuits for vehicle subsystems are protected by mechanic 
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manually turned "OFF" for maintenance. These electrical circuits are also further 
protected by mechanicaUy locking them out with plastic cable ties or tie wraps placed 
around the circuit breaker shafts. Also, since the electronic circuits require manual 
activation they had to be located within the cockpit area for immediate accessibUity 
where fUght crew personnel could see those circuits with tie wraps. The tie wraps 
prevent flight ciew personnel in the vehicle fix>m inadvertentiy reapplying electrical 
power to ttie subsystems tiiat are in a maintenance mode and, therefore, should not 
receive electrical power. The tie wraps also act as visual indicators of electtonic 
circuits that are intentionaUy turned "OFF" (puUed out) to protect circuits which are in 

maintenance mode. 

In more advanced vehicles, electrical circuits arc protected by solid state 

power controUers (SSPCs) tiiat act as circuit breakers, as well as control power to 

associated subsystems. These soUd state devices are generaUy remotely located and 

controlled tiirough software. The SSPCs are designed to turn "OFF' power to down 

stream wiring and subsystems when tiiey sense an elecoical fault witiiin the system 

architecture. Internal to tiie SSPC is fault sensing circuitry tiiat can be tailored for 

various fault conditions. 

Additionally, tiie SSPCs contain circuitry tiiat provides advanced 
features such as current limiting, self-test and status monitoring. After electrical power 
is appUed to SSPCs tiiey have ttie abUity to be continued "ON/OFF" via a system 
controller. Upon application of electrical power tiie system controUer wiU set tiie start- 
up SSPCs to an "ON" state, which provides electrical power for critical start-up loads. 
Only after ttie initial start-up loads have been turned "ON" can tiie pUot manually ( via a 
computer interface) turn tiiem "OFF" or reconfigure tiie start-up load configuration. If 
during tiiis power "ON" period tiie system conttoller loses power (power mterrupt) it 
will revert back to turning "ON" tiie start up SSPCs. Hence, the present state of the art 
soUd state circuit breaker system does not provide tiie capability to permanently turn 
SSPCs "OFF" for maintenance. This presents a serious problem since tiie operators of 
a vehicle may not be aware of die operational status of tiie subsystems of ttie vehicle. 
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Also, a power interruption may change the operational status of the subsystems, which 
presents a hazardous condition for maintenance personnel and flight crew personnel 
since they may not be aware of those electrical circuits being re-energized after the 
interrupt period. 

What is needed is an advance in the state-of-the-art that would raise the 
level of safety during maintenance and operation of a vehicle by providing a non- 
varying operational status of vehicle subsystems and providmg information regarding 
that status to flight crew personnel. 



BRIEF SUMMARY OF THE INVENTION 
The instant invention provides a solution to the above-noted problems 
by providing a system for establishing the operational status of electronic circuits and. 
thus, an associated vehicle subsystem. The operational status data is stored in a 
limited-access, non-volatile memory, thereby preventing modification of tiie 
operational statijs data by unautfiorized personnel and/or electrical power interruption. 
The instant invention also has the capabiUty to output data relating to tiie operational 
status of the vehicle subsystems to flight crew personnel. 

Accordingly, one embodiment of die instant invention is directed to an 
apparams for controUing die operational state of one or more electrical circuits. This 
apparatus includes a power source capable of providing electrical power to each of the 
electrical circuits and an input module tiiat is used to generate status data relating to an 
operational statiis of each of tiie electrical circuits. A control module is coupled to tiie 
power source, and each of tiie electrical circuits. The control module receives tiie status 
data from tiie input module and stores tiie status data in a non-volatile storage medium 
so that tiie status data is maintained when electrical power is interrupted. The control 
module prevents particular electrical circuits, which have been designated as non- 
operational, from receiving electrical power from tiie power source. The stams data is 
modified by the input module. 
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Another embodiment of the instant invention is directed to a method, 
which is stored on a computer-readable medium, for providing information relating to 
the operational state of a plurality of electronic circuits. This method includes 
generating status data in accordance with an operational state of each electronic circuit. 
The status data is stored in a non-volatUe memory medium th^t prevents modification 
of the status data when power is interrupted- The status data is transmitted to a 
processor that prevents electrical power transmission to electronic circuits that are 

designated as non-functional. 

Yet another embodiment is directed to an apparatos for controlling an 
operational status of a pluraUty of helicopter subsystems. The apparatus includes an 
external input module, adapted to modify the operational status of heUcopter 
subsystems and generate operational status data. A processing module receives the 
operational status data and stores the operational status data in a non-volatile storage 
medium that prevents modification of the operational status data. A pluraUty of power 
control circuits are coupled to the processing module and the control circuits receive the 
status data. Each power control circuit operates according to the operational status 
data. A pluraUty of helicopter subsystems, each of which is coupled to an associated 
power control circuit, operates according to the operational state of the associated 
power control circuit. The operational state of tiie conti-ol circuit is either ON, OFF or 
LOCKED-OUT. The helicopter subsystems that have been designated as LOCKED- 
OUT wiU not receive electrical power until die operational status has been changed to 
ON or OFF by input from the external input module. 



BRIEF DESCRIPTION OF THE DRAWINGS 
FIG. 1 shows a system architecture for one embodiment of the instant invention. 
FIG. 2 shows a flow chart of the steps to "LOCK-OUT* designated electiical circuits. 
FIG. 3 shows a display of the operational status of subsystems of a vehicle. 
FIG. 4 shows a display of subsystems tiiat have been "LOCKED-OUT". 
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HGs. 5A and 5B show a flowchart of steps to implement the instant invention. 

FIG. 6 shows a detailed view of an electrical circuit 

FIG. 7 shows gate array logic for the instant invention. 

FIG. 8 shows a helicopter coupled to an external maintenance computer. 

Like reference numbers and designations in the several views indicate 

like elements. 



DETAILED DESCRIPTION OF THE INVENTION 
The instant invention provides a system to control the operational status 
of electrical circuits, which as discussed herein are either power control circuits, or 
subsystems, or a power control circuit and an associated subsystem. The system 
outputs maintenance mode display data indicatmg the operational status of the electrical 
circuits. Power control circuits, such as solid state power control devices (SSPCs), are 
controlled by programmable maintenance mode capabilities. Once a designated SSPC 
has been "LOCKED-OUT" through this maintenance mode it wUl be kept "LOCKED- 
OUT" until the system is reprogrammed to aUow it to be turned "ON" or "OFF". 

An "ON" operational state permits operation of the subsystem. An 
"OFF" operational state permits the subsystem to be mmed "ON". A "LOCKED-OPT" 
operational state prevents operation of the particular subsystem. UsuaUy, only 
authorized maintenance personnel are permitted to program the SSPCs to "LOCKED- 
OUT" state, "OFF' and "ON" states can be commanded by eithw the maintenance 
personnel or the flight crew. An output display wUl aUow flight crew personnel to 
receive a list of die operational stams of each electrical circuit during power up or on 
demand. During power outages, the system wUl retain a prior lock out operational 
status of an electrical circuit and shall return the electrical circuit to that state when 

power is restored. 

HG. 1 shows die components of system 10, which includes an external 
maintenance computer 164 and components of a vehicle electrical system 170. The 
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external maintenance computer 164 is coupled to the vehicle electrical system 170 by a 
bidirectional data bus 168. The vehicle electrical system 170. as shown, includes an 
air vehicle interface computer system module (AVICS) 160, mission computer cluster 
(MCC) 166, crew station display module 108, electric power supply 104. and power 
system control module 1 12. It is {^parent to those skUled in the art that vehicle 
electrical system 170 could function with less than all of the conqmnents shown. 

The external maintenance computer 164 is an intelligent maintenance 
aid, used to transmit data into a bidirectional data communication interface 168. such as 
a 1553 data bus. The external maintenance computer 164 is typically a portable PC, 
such as a lap-top computer, with application software to act as a maintenance aid and 
perform test procedures on the vehicle electrical system 170. The external maintenance 
computer 164 is used to generate a list of aU vehicle subsystems 146(a)...(n) (where n is 
any suitable number that comports with the design specifications of system 10) and an 
operational status of each of the subsystems 146(a)...(n). Vehicle subsystems 
146(a)...(n) are also referred to generally as 146 herein. The external maintenance 
coii4)uter 164 has software that enables an operator to scroll through a listing of each 
subsystem 146(a)...(n) and establish an operational state of "LOCKED-OUT" for each 
subsystem 146, and corresponding power control circuit, undergomg maintenance 
action. Typically the maintenance personnel, also referred to as operators herein, will 
be lequired to enter an access code prior to modifying the operational status of any 
electronic circuits. This access code is suitably a user password. 

Once the lock out status of each subsystem 146(a)...(n), and associated 
power control circuit 1 16(a)...(n), has been determined, the operator saves the data in 
memory as a lock-out matrix and exits that application of the maintenance program. 
Although the data is described herein as being stored in a lock-out matrix, it is apparent 
to those skilled in the art that the data could be stored as a spreadsheet or Usting. The 
matrix configuration is used as an efficient way to store a particular electronic circuit 
1 16 and a status for that circuit and corresponding subsystem 146. The external 
maintenance computer 164 transmits the stored information through the bidirectional 
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data communication interface (e.g.. data bus)168 to MCC computer 166, which 
foiwards the data to an intennediate computer, such as an air vehicle interface computer 
system module (AVICS) 160. which is part of vehicle electrical system 170. In general, 
the AVICS 160 would not need to be an essential part of a system 170. Upon 
completion of maintenance procedures, the external maintenance computer 164 is de- 
coupled from the vehicle electrical system 170 and the vehicle (not shown) can be 
operated. 

The vehicle electrical system 170 includes an AVICS module 160. 
mission computer cluster 166. crew display output module 108, power system control 
(PSC ) module 1 12. electric power supply 104 and electronic subsystems 146 (a)...(n), 
referred to generally herein as numeral 146. The vehicle electrical system 170 is 
suitably coupled to the external maintenance computer 164 through data bus 168. 

The mission computer cluster (MCC) module 166 serves as the central 
data bus traffic controUer for the system 170. It retrieves data and status from all 
system components during precise, periodic time intervals, performs computations and 
logic on the data in accordance with preprogrammed directions, and issues commands 
or displays information back to the components of the system 170 at other precise time 
intervals. AU items connected to data bus 168 thus communicate to the MCC 166, and 
MCC166 then forwards data as appropriate. Further, MCC 166 organizes and formats 
information and status for presentation in a user-desirable format on display 108. 

The crew display output module 108 receives and transmits data to and 
from the MCC module 166. The crew display output module 108 provides output data 
visuaUy on display screen 132 that shows the present operational state of power conttol 
circuits 1 16 (a)...(n) and thus the operational status of the associated electronic 
subsystems 146 (a)...(n), respectively of the vehicle electrical system 170. The crew 
display output module 108 is typically located in the cockpit of the vehicle, where it is 
readily accessible by flight crew persom»el during operation of the vehicle. The crew 
uses display 108 to input power control commands to the system 170. The display 108 
provides a scroll control and power switch to allow each component of system 170 in 
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the vehicle to receive commands. U)cked-out systems 146 are indicated and no crew 
control is available for those systems. 

The AVICS module 160 receives data such as the lock-out matrix from 
the external maintenance computer 164. via data bus 168. which is a bidirectional data 
communication interfece. The AVICS module 160 then transmits Ihe operational stams 
data Le. lock-out matrix to the PSC module 1 12. via data bus 148. Data bus 148 is 
suitably a bidirectional data communication interface, such as an RS-422 data bus. 
AVICS module 1 60 also suitably receives data from the PSC module 112 and transmits 
that data to the mission computer cluster 166 and external mamtenance computer 164. 
if the external maintenance computer 164 is coupled to v«*icle electrical system 170. 
-nius. MCC 166, output display 108 and AVICS 160 are in bi-directional 
conununication with one another. 

Power system control (PSQ module 1 12 is in bidirectional 
communication with AVICS module 160 via bidirectional data communication 
interface 148. which is suitably an RS-422 data bus. The PSC module 112 comprises a 
PSC processor module 120. non-volatile memory module 144. gate array module 1 14. 
and a plurality of electrical power control circuits 1 16(a)...(n) (n is any suitable nmnber 
that comports with the design of system 10) for example, a typical helicopter has 120 
power control circuits 116 (a)...(n). The PSC module 112 controls power distribution 
to vehicle subsystems 146(a)...(n) via wires 176(a)...(n). respectively. 

PSC processor module 120 receives operational stams data from tiie 
external maintenance computer 164 via the MCC166, and typically via AVICS module 
160. Alternatively, the PSC processor module 120 could receive ti^ opemtional status 
data ftom the external maintenance computer 164 withoutthe AVICS module 160. Bus 
148 is used to transmit data ftom the AVICS module 160 to PSC processor module 
120. PSC processor module 120 stores the operational stams data in a limited access, 
non-volatile memory module 144 viabus 152. Alternatively, die non-volatile memory 
could be located witiiin PSC processor module 120. The memory module 144 is 
limited access because in order to modify the contents of the memory module 144. a 
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user password or access code is required. This limited access prevents unauthorized 
modification of the operational status of power circuits 116. The location of the non- 
volatile memory is a design choice and is not critical to understanding the invention. 
This non-volatUe memory is suitably EEPROM memory that stores the operational 
stams data as a lock-out matrix 124 so that the lock-out matrix 124 is not modified by 
or during power intemiption. System programming prevents unauthorized 
modification of the lock-out matrix 124. Once the external maintenance computer 164 
is removed from the vehicle electrical system 170, the maintenance memory module 
144 stores the operational status data, shown as lock-out matrix 124, and the processor 
120 does not permit modification of die lock-out matrix 124 until external maintenance 
module 164 is reattached and an authorized password is provided. This typically occurs 
when the next maintenance or repair procedure takes place, which suitably requires 
coupling die external maintenance computer 164 to vehicle electrical system 170. 

The PSC processor module 120 then remeves the lock-out matrix 124 
from memory module 144 and transmits die lock-out matrix 124, which represents die 
operational status of all die electronic circuits 1 16(a).,.(n), to gate array module 1 14 via 
bus 152. 

Gate array module 1 14 is suitably a field programmable gate array 
(FPGA) module diat comprises logic and a flip-fiop gates, shown as gate logic modules 
1 15(a)...(n) (where n is any suitable number diat comports widi die design of the system 
10), which correspond to an associated power control circuit 1 16(a)...(n). (The power 
control circuits 1 16 are also referred to as solid state power controUers, or SSPCs.) The 
gate array module 1 14 is coupled to power control circuits 1 16 (a) ..(n) by command 
lines 186 (a)...(n), respectively. The lock-off state for each SSPC 116 is loaded into die 
gate array 1 14 such dmt each SSPC flip-flop control is either held in a "clear" or "off 

state for "LOCKED-OFF" of SSPCs so ttiey can not be energized; or not-clear so they 

are controUable. Gate logic module 1 15 is illustrated in HG. 7. 

As shown in FIG. 7, each gate logic module 1 15(a)...(n), (shown 

generally as numeral 1 15) shown in FIG. 1 comprises a lock-off input, shown as line 
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702. which is received by flip-flop 1 (FFl), shown as numeral 706. A second lock-off 
input is transmitted through gate 704 to FFl. 706. A first output "Q" is transmitted to 
gate 714 via wire 710. A second output "Q"is transmitted from FFl, 706 to gate 720 
via wire 708. Gate 714 also receives off input via wire 7 12 and outputs a signal via Una 
716 to flip-flop 2 (FF2). 724. Gate 720 receives on input via line 722 and outputs an 
input to FF2, 724 via wire 7 1 8. FF2, 724 transits an output to the power control circuit 
via wire 186. The lock-off state is designated "logic 1" sets FFl. which introduces a 
"dear" input to FF2 and disables the "set" inputs and gate. This prevents an "on" 
command from any source passing into the PSC and energizing the associated SSPC 

over output line 186. 

Referring back to FIG. 1, the power control circuits 1 16 (a)...(n) are each 
coupled to an associated electronic subsystem 146 (a)...(n). via power deUvery lines 
176(a)...(n), respectively. The PSC processor module 120 also generates information 
that is transmitted to mission computer cluster 166 via bus 148 and bus 168 for display 
on module 108. The output module 108. which is shown as a crew station display, 
provides crew members information relating to those subsystems 146 that have been 
designated as "LOCKED-OUT", and those tiiat are otherwise either "OFF' or "ON". 
The lock off Ust can be in the form of an informational status Notice regarding lock-off 
systems which can be displayed on a screen 132 of output module 108. The mission 
computer cluster 166 retrieves die "LOCKED-OUT' status ftom PSC 1 12 via AVICS 
160 and organizes tiiem into a special warning messagp on Notice. Then die MCC 166 
forwards die Notice to display 108 for immediate visual indication to die flight crew. 
The indication interrupts normal display activity so tiiat the flight crew takes 
unavoidable notice of die systems locked-out at die current time. The crew is tiiem 
empowered to dismiss the message and continue with normal display activity. This 
alert feature serves die same function here as Uie visual scan by the flight crew of the 
circuit breaker panel (looking for tie-wrap conditions) used in a conventional vehicle 
system. 
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Power control circuits 116(a)...(n), (where n is any suitable number that 
comports with vehicle electrical system 170) are suitably coupled to the gate array 
module 1 14 by commend lines I86ta)...(n). respectively. The power control circuits 
1 16 (a)...(n), which are typically solid state devices, are used to control electrical 
cunent, or power, to an associated vehicle subsystems 146 (a)...(n), respectively, via 
wires 176 (a)...(n) respectively. The power control circuits 1 16(a)...(n) will not provide 
power to the associated subsystem 146 (a)...(n) if the power control circuit is 
"LOCKED-OUT* by the gate array. The power control circuits, generally referred to as 
1 16, are controlled by software, which can be running on a processor that is remotely 
located from the power control circuits 1 1 6. When the controller e.g. PSC processor 
120 receives instructions firom the lock-out matrix 124. the selected power control 
circuits will transmit electrical cunrent, Le., provide power, to the associated electrical 
subsystem 146. Thus, the operational states of the particular power control circuit 1 16 
(b) will determine whether an associated subsystem 146 (b) receives power. If the 
power control circuit 1 16 (b) is designated as "ON", the associated subsystem 146 (b) 
will receive electrical power. If the power control circuit 1 16 (b) is designated as 
"OFF*, the associated subsystem 146(b) will not receive electrical power unless the 
flight crew personnel, or another subsystem turn the power control circuit "ON". If the 
power control circuit 1 16 (b) is designated as "LOCKED-OUT', the associated 
subsystem 146 (b) wiU not receive electrical power, regardless of efforts by flight crew 
personnel or other vehicle subsystems (Le., MCC 166 or AVICS 160). 

Power supply 104 is either an AC or DC power source used to provide 
electrical power to vehicle electrical system 170. The magnitude of power supply 104 
is typicaUy 270 volts, although any suitable power supply could be used. The power 
supply 104 is coupled to each power control circuit 116 (a)...(n) via wires 188 (a)...(n), 
respectively. 

Electronic subsystems 146(a)...(n). as stated above, are each associated 
with a corresponding power control circuit 1 16(a)...(n), respectively. These subsystems 
146 (a)...(n) arc. for example. utUity Ughts, cockpit back-up fan, turret gun control and 

11 
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Other subsystems in a helicopter. They are listed in a maintenance mode look-up table 
such that maintenance personnel, using external maintenance computer 164, are able to 
set the operational status of the associated power control circuit 1 16 to lock-off if 
desired. 

FIG. 6 shows a detailed view of a particular electrical circuit 600(a) that 
includes a power cohtrol circuit 116(a) and a subsystem 146(a). The embodiment of 
FIG. 6 shows that the power control circuits, generally referred to as numeral 1 16, and 
an associated subsystem, generally referred to as numeral 146 of FIG. 1 form a single 
unit 600 (unit 600(a) specificaUy shown in FIG. 6). Power control cuicuit 1 16(a) 
includes a switch 1 17(a) that is controUed by an associated gate logic module 11 5(a) of 
gate array module 1 14, via wire 186(a). The switch 1 17(a) controls power transmission 
to subsystem 146(a) by its position. 

FIG. 2 shows a flow chart 20 used to describe the functional lock-out 
software of the instant invenUon used to "LOCK-OUT" a power control circuit and the 
conespondmg electrical subsystem. As shown in HG. 2. foUowing start block 206, 
block 208 receives a command to turn "ON" a particular power control circuit. This 
command is suitably received via a bidirectional data communication interface, such as 
an RS-422 data bus, or internally gated "ON" . If the power control circuit is not 
commanded "ON", the operational status of the power control circuit does not need to 
be determined and Une 210 shows the end block 222 is the next step. If the power 
control circuit is commanded to turn "ON", line 212 leads to block 214, which shows 
that a check is performed to determine whether the particular power control circuit, and 
thus the associated electrical subsystem, is Usted as "LOCKED-OUT". hi such a case, 
the particular power control circuit will not receive electrical power, and thus, the 
associated subsystem will not receive power. If the particular power control circuit is 
designated "LOCKED-OUT*, Une 216 shows that end block 222 is reached. If the 
particular power control circuit is not "LOCKED-OUT', the power control circuit is 
energized, or receives electrical power, as shown by line 218 leading to block 220. 
line 224 shows that decision block 221 determines whether additional power control 
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circuits, also referred to as SSPCs. are in the array. If "YES" line 226 leads to block 
208. If there are no more SSPCs. line 223 shows that end block 222 is reached. 

FIG. 3 shows a maintenance mode display page 30 thai displays a listing 
of 147 (a)...(n) each subsystem of the vehicle and the present operational states of each 
subsystem 302 (a)...(n). This maintenance mode display page 30 enables a user to 
scroll through the list to determine whether the status has been determined "ON". 
"OFF" or "LOCKED-OUT". Typically only maintenance personnel will have 
authorization, through an access code, to reconfigure the operational status of the 
subsystems id lock-out. This is typicaUy done by coupling an external maintenance 
computer to the vehicle. Maintenance personnel, using software that produces the 
display page 30, scroll through the list and set the operational status of each subsystem 
Usting 147 (a)...(n) and thus the corresponding power control circuit. They are 
authorized to alter the data matrix, with those subsystems needing repair designated as 
"LOCKED-OUT". This operational data matrix, also referred to as a lock-out matrix, 
is transmitted to a control module, such as the PSC module described in FIG.l. where it 
is stored in Umited access non-volatUe memory. Typically. Once the operational data 
matrix has been stored in memory, crew members will not be able to energize 
subsystems that have been "LOCKED-OUT" or otherwise modify the operational data 
matrix. The control buttons of the output device are shown as elements 304-322. 

As shown in FIG.4, the crew members can acces:| the operational data 
matrix to obtain information related to those subsystems that have been "LOCKED- 
OUT' by maintenance personnel. This provides information to crew members as 
which subsystems cannot be energized during operation of the vehicle. 

The operational data display 35 highUghts only the subsystems 
designated as "LOCKED-OUT'. thereby enabling the crew members to view only non- 
operational subsystems. The listing of each subsystem is shown as 147 (b)...a) and the 
listing of the associated status is shown as 302 (b)...(i). 

HGs. 5A and 5B are a flow chart 40 of .steps, which are suitably stored 
on a computer readable medium to implement the instant invention. The steps include 
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Start block 402, followed by block 404. In block 404 a maintenance mode look-up 
table is displayed using an external computer module. An operator, using an external 
computer, establishes the operational siams of the subsystems, and thus, the associated 
power control circuits as "LOCKED-OUT" as shown in block 405. The statos 
"LOCKED-OUT* indicates that the subsystem is not capable of receiving electrical 
power due to repair needs or maintenance requirements. The "LOCKED-OUT* status 
prevents the subsystem from receivmg electrical power by placing the associated gate 
array power control flip-flop circuit in a 'LOCKED-OUT' or "LOCKED-OFF' state. 
Thus, the power control circuit prevents the associated subsystem from receivmg 
electrical power. The result of establLshing an operational status of each subsystem is a 
lock-out matrix. An "ON" state means that the power control circuit is transmitting 
power. An "OFF* state means that although the power control circuit is not 
transmitting power, it is capable of being tumed "ON". 

As shown in block 406 electrical power is removed from circuits 
designated as "LOCKED-OUT". As shown in block 408, the maintenance mode look 
up table is logged out, thereby preventing modification of the lock-out matrix by 
unaudiorized personnel or, alternatively, by members of the crew who wish to modify 
the power status of various subsystems. 

As shown in block 410, lock-out matrix transmitted from the extemal 
computer module to a storage medium via a data bus. As shown in block 412, the lock- 
out matrix is stored in non-volatUe limited access memory to prevent modification if 
power is interrupted in the system or other subsystems or flight crew personnel attempt 
to access a subsystem that has been designated as "LOCKED-OUT". This enables the 
loGk-out matrix to maintain its present status regardless of power surges and/or power 
interruptions. The stability of the lock-out matrix increases the safety of the vehicle 
since the power control circuits associated with lockcd-out subsystems prevent 
electrical power from being transmitted to those subsystems. As shown in block 414, 
the lock-out matrix is transmitted to a gate array module. Tlie gate array module 
controls the state of electronic circuits according to die lock-out matrix data. 

14 
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As shown in block 416, data regaiding those subsystems that have been 
"LOCKED-OUT" is output to an output tenninal. This output terminal is typically a 
crew station display that enables the flight crew members to have information relating 
to electronic circuits that have been loclced out and, thus, information relating to 
subsystems that are unavailable for use. 

As shown in block 418; elecuical power can be provided to those 
subsystems that are designated as operational Le. either "ON" or "OFF'. As shown in 
block 420, electronic circuits that are operational can receive commands and function 
as designed. 

Block 422 is a decision block that determines whether additional 
maintenance and/or repair actions are required. If so line 434 shows an external 
maintenance computer can be connected to the vehicle as shown in block 424. In order 
to modify the lock-out matrix, an authorized access code must be used, as shown in 
block 426. Line 428 shows that once an authorized access code has been received form 
the external maintenance computer, the look-up table may be modified to generate a 
modified lock-out matrix. The process then repeats with the modified lock-out matrix. 

If additional maintenance and/or repair is not required line 430 leads to 

end block 432. 

FIG. 8 shows a vehicle, specifically a helicopter, 800 coupled to an 
external maintenance computer 164, via bus 168. Once a maintenance procedure is 
complete, the extemal computer 164 is detached from the vehicle 800. 

An example of the system described herein wiU now be discussed using 
reference to FIGs. 1-8. This example is merely one embodiment of the instant 
invention and is not intended as limiting the invention to the example discussed. It is 
readily apparent to those skilled in the art that the instant invention has applications to 
other power supply systems. 

A heUcopter, with a plurality of subsystems, experiences a malfunction 
of the turret gun subsystem (TGS). The helicopter is connected to an extemal module 
that displays a list of each subsystem (maintenance mode look-up table). (See HG. 3) 
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a particular designated operational status of particular electronic circuits. For example, 
such a system can be q[>pUed to a residential housing structure. In ttiis embodiment, 
home appliances, such as oven, range and dishwasher would be connected to power 
control circuits, for example, circuit breakers. The status of the circuit breakers is 
stored in a processor module. A rq>air ^hnician programs the status of each power 
control circuit prior to working on a designated appUance. This prevents the appliance 
from receiving electrical power untU the technician programs the power control circuit 
from "LOCKED-OUT" to an "ON" or "OFF' state. This enables a technician to safely 
repair home appliances without the worry of .shock or unintended electrical current 
shorting out an appliance under repair. 

While the invention has been described above with rcferwice to specific 
embodiments thereof, it is apparent that many changes, modifications and variations 
can be made herein. Accordingly, it is intended to embrace all such changes, 
modifications and variations that fall within the spirit and broad scope of the appended 
claims. 
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What is claimed is: 

L An apparatus for controlling the operational state of one or more 

electrical circuits comprising: 

a power source capable of providing electrical power to each of the 

electrical circuits; 

an input module, for generating status data relating to an operational 

status of each of the electrical circuits; and 

a control module, coupled to the power source, and each of the electrical 
circuits, for receiving the status data from the input module and storing the status data 
in a non-volatile storage medium so that the status data is maintained when electrical 
power is interrupted and the control module for preventing particular electrical circuits 
that have been designated as non-operational from receiving electrical power from the 
power source, 

wherein the smnis data is modified by the input module. 

2. The apparatus according to Claim 1 fiirther comprising an output 
module, coupled to the control module, for displaying information corresponding to the 
operational status of each electrical circuit. 

3. The apparatus according to Claim 1 wherein the output module 
displays output data corresponding to those electrical circuits designated as non- 
operational. 

4. The apparatus according to Claim 3 wherein the output module 
comprises a display screen for displaying the output data. 
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5. The apparatus according to Claim 1 wherein the status data is 
stored in a matrix that designates those electrical circuit that are prevented from 
receiving electrical power. 

6. The apparatus according to Claim 5 wherein an access code is 
lequired to modify the status data stored in the matrix. 

7. The apparatus according to Claim 1 wherein the electrical 
circuits are solid-state devices. 

8. The apparatus according to Clahn 1 wherein the electrical 
circuits are subsystems of a vehicle. 

9. The apparatus according to Claim 6 wherein the control module 
and electronic circuits are located on a vehicle. 

10. The apparatus according to Claim 9 wherein the vehicle is a 

helicopter. 

U . The apparatus according to Claim 2 wherein the status data 
designates each of the electronic circuit as "on" "off* or "locked-out" and the output 
module displays the status data in a cockpit of a vehicle. 

12. The apparatus according to Claim 10 wherein the matrix is 
prevented from modification by a vehicle operator. 

13. The apparanis according to Claim 12 wherein the input module is 
detachable from the vehicle. 
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14. A method for providing information relating to the operational 
state of a plurality of electronic circuits stoied on a computer-readable medium 
comprising: 

generating status data in accordance with an operational state of 
each electronic circuit; 

storing the status data in a non-volatile memory medium that 
prevents modification of the status data when power is interrupted; and 

transmitting the status data to a processor that prevents electrical 
power transmission to electronic circuits that are designated as non-functional. 

15. The method accordmg to Claim 14 further comprising outputting 
a status indication of non-operational electronic circuits to a user interface. 

16. The method according to Claim 14 wherein the status indication 
is a graphical indication of non-operational electronic circuits. 

17. The method according to Claim 14 wherein the status data is 
updated after acceptance of an access code. 

18. The method according to claim 17 further comjMising 
designating an operational status each electronic circxiit as "on" "off or "locked-out". 

19. An apparatus for controlling an operational status of a pluraUty 
of vehicle subsystems comprising 

an external input module, adapted to modify the operational status of 
vehicle subsystems and generate operational status data; 

a processing module, for receiving the operational status data and storing 
the operational status data in a non-volatile storage medium that prevents modification 
of the operational status data; 
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a plurality of power control circuits, coupled to the processing module, 
for receiving the stams data and each power control circuit operating according to the 

operational status data; and 

a plurality of vehicle subsystems, each of which is coupled to an 
associated power control circuit for operating according to the operational state of the 
associated power control circuit that has an operational status of ON, OFF or 
LOCKED-OUT, 

wherein a vehicle subsystem that has been designated as LOCKED-OUT 
will not receive electrical power until the operational status has been changed to ON or 
OFF by input from the external input module. 

20, A method for controlling the operational status of a plurality of 
vehicle subsystems comprising: 

coupling a niaintenance computer to the vehicle, for designating an 
operational status of each subsystem of the vehicle; 

storing operational status data in a non-volatile, limited access memory 
module, located in tiie vehicle that prevents modification of tiie status data by power 
interruption or unauthorized input; 

decoupling the maintenance computer from the vehicle; 

transmitting the operational status data fi-om the non-volatile, limited 
access memory module to a gate array tiiat controls whetiier a particular subsystem 
receives electrical power; 

providing electrical power to designated vehicle subsystems in 
accordance with the operational status data; and 

outputting a status signal indicative of particular vehicle subsystems that 

are non-operational. 
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